资源描述：
《securing grid data using mandatory access controls》由会员上传分享，免费在线阅读，更多相关内容在工程资料-天天文库。
1、SecuringGridDataUsingMandatoryAccessControls∗MattHenricksenWilliamCaelliPeterCrollInformationSecurityInstitute,QueenslandUniversityofTechnology,GPOBox2434,Brisbane,Queensland,4001,Australia.Email:{m.henricksen,w.caelli,p.croll}@qut.edu.auAbstractMaliciousoraccidentalcompromiseof
2、theordinaryuser’saccountshouldnotaffectotherusersortheThemaincontributionofthispaperistoinves-operatingsystemitself.Thatis,theuser’sactivitiestigateissuesinusingMandatoryAccessControlsshouldoccurinasandboxcomprisedoftheobjects(MACs),namelythoseprovidedbySELinux,tose-andresourcesa
3、vailabletothatuser.Inawell-securedcureapplication-leveldata.Particularemphasisissandbox,resourcesaretightlycontrolled.Aproblemplacedonhealth-carerecordslocatedonthegrid.affectingprocesseswithinthesandboxcannotspreadThepaperdisccusestheimportanceofatrustedcom-beyondthesandboxbound
4、aries.Forexample,codeputingbaseinprovidingapplicationsecurity.Itde-executedbyaprocesswithinthesandboxcannotaf-scribesasecurethree-tieredarchitecture,incorporat-fectcodeordatainanothersandbox.ingtrustedhardware,SELinux,andapplicationse-ProblemswiththeeffectivenessofDACarewellcurit
5、ymechanismsthatareappropriateforsecuringdocumented,becauseitdoesnotproperlysupportsensitiveapplicationdata.sandboxing.Anexampleisnowgiveninwhichtheor-dinaryuserrunsaninstanceoftheApachewebserverthatservesweb-pagestovisitingWWWbrowsers1Introduction1(Gayal2003).TightlyconfiguredDAC
6、smakesensi-tivedatainaccessibletothebrowser.WhenavisitorItiswellknownthatsecurityintheapplicationspacerequestssensitivedatafromthebrowser,thebrowsercannotexistwithoutparticularsecurityprerequisitesreturnsa403‘non-accessible’error.However,inaatlevelsofhardware,operatingsystemsand
7、anymid-successfulattack,amaliciouspartylaunchesabufferdlewaresub-systems(Loscocco,Smalley,Muckelbaur,overflowattackontheApacheprocess.ThroughtheTaylor,Turner&Farrell1998).Theseprerequisitesuseoftheprocesstracingtoolptrace,whichcon-includedomainseparation,whichpreventsunrelatedtrol
8、stheexecutionofotherprocesses,theattackersystem
